1042 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
enricobuehler	f4c3a5d0c3	fix(clients): shared-VkQueue race + swapchain recreate destroy-in-use — the intermittent device-lost stream killer ... Live-diagnosed on the RTX box during the adaptive-bitrate A/B: 2 of 3 streams died with VK_ERROR_DEVICE_LOST at stream start or at a mid-stream encoder rebuild, then zombied — the demote-to-software path rebuilt the decoder against the same dead device, FFmpeg wedged inside the rebuild, and the pump flushed a never-draining backlog every 2 s forever. No OS TDR: the client's own Vulkan misuse. Two causes: 1. The presenter creates ONE graphics-family queue and hands FFmpeg's AVVulkanDeviceContext the same family (nb_graphics_queues=1 ⇒ queue 0) for its transfer/compute prep — so the pump thread and the presenter thread submitted to the SAME VkQueue with no shared lock, violating vkQueueSubmit's external-sync rule exactly when FFmpeg puts work on the graphics queue (decoder open / frames-context rebuild = stream start and every ABR encoder re-target). New guard-less QueueLock (FFmpeg's lock_queue/unlock_queue callbacks are a raw pair) shared by all four queue users: FFmpeg (callbacks installed via user_opaque), the presenter's submit/present/wait-idle, and the Skia overlay's flushes. 2. Swapchain recreation destroyed the old swapchain + render semaphores after ONE fence cycle — the fence proves our submit, not the presentation engine's semaphore consumption (VUID-vkDestroySemaphore-05149 + VUID-vkDestroySwapchainKHR-01282 on every recreate). Recreate now drains the queue (vkQueueWaitIdle under the shared lock — safe now that FFmpeg honours it) and destroys immediately; the deferred DisplayGarbage machinery is gone. Resilience: VK_ERROR_DEVICE_LOST anywhere in a present error chain is now fatal — the run loop fails the session loudly instead of demoting to software on a dead device (the zombie path). Verified on the RTX box (RTX 4090 → host .21) under VK_LAYER_KHRONOS_validation: 3/3 stream start/stop cycles clean, then 8 mid-stream encoder rebuilds in one session (4 ABR down-steps under 10% induced loss + 4 clean-link recovery up-steps — the exact scenarios that previously killed the device): 0 device losses, 0 wedges, both recreate VUIDs gone (previously fired on every path). Remaining validation messages are FFmpeg's own video-session VUIDs, untouched by this change. Linux: clippy -D warnings + tests green (home-worker-2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 12:42:11 +02:00
enricobuehler	4839c0e6f6	fix(ci): windows clippy + rustfmt debt from the D3D11VA push ... The windows workflow has been red since a69a83b5: clippy 1.96 rejects the two field-reassign-with-default view-desc initializers in video_d3d11.rs (now struct literals), and with clippy failing first, the rustfmt step never ran — cargo fmt --all had genuine misses queued up in video_d3d11.rs / pf-presenter d3d11.rs + vk.rs / core abr.rs + client.rs (plus this session's config.rs). Formatting only beyond the two initializers; no behaviour change. Verified: clippy -p pf-client-core --all-targets -D warnings clean on the RTX Windows box, cargo fmt --all --check clean, core lib tests green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 11:47:06 +02:00
enricobuehler	d0f68cbbcd	feat(core,host): per-family MTU shard sizing — the IPv6 gating item ... Phase 1 of the dual-stack plan (design/client-parity-and-network-resilience.md, plan 5): the host sizes each session's shard_payload from the QUIC remote's address family instead of assuming IPv4 — 1408 over v4 (unchanged), 1388 over v6 (40-byte header). Rides the existing Welcome::shard_payload negotiation, so there is zero wire change and old clients simply follow. This has to land before any v6 data path exists: the v4-maximal 1408 makes every sealed video datagram overshoot a 1500-MTU IPv6 hop, and v6 routers never fragment — that's a blackhole (every datagram dropped), not the graceful-ish degradation of the b5c30df v4 fragmentation saga. IPv4-mapped v6 remotes (::ffff:a.b.c.d, what a dual-stack [::] socket reports for a v4 client) correctly keep the v4 size — they ride IPv4 on the wire. New mtu1500_shard_payload_v6()/mtu1500_shard_payload_for() in core config with the same pinned never-fragments/maximality tests as the v4 constant, plus a family-selection test. Verified: 82 core lib tests + loopback/c_abi green and host check/clippy clean on Linux (home-worker-2); core tests green on macOS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 11:35:28 +02:00
enricobuehler	13d1aa5738	feat(clients/android): OnFrameRendered display stage — HUD headline becomes capture→displayed ... The long-deferred Android display stage (design/stats-unification.md; plan 4.1 of design/client-parity-and-network-resilience.md): AMediaCodec_setOnFrameRenderedCallback (API 26, under the minSdk-28 floor ⇒ hard-linked via ndk-sys) reports SurfaceFlinger's per-frame render timestamp, giving the HUD the spec's `display` = decoded→displayed term and the directly-measured capture→displayed end-to-end headline on both decode loops. Falls back per spec to the v1 capture→decoded endpoint on any window without render callbacks (the platform may drop them under load), and to it permanently if registration is refused. - The render timestamp arrives on CLOCK_MONOTONIC; it's re-based onto CLOCK_REALTIME against monotonic-now at callback time, which also cancels the (batchable) callback delivery lag. - The `ndk` crate exposes neither the callback nor the codec pointer needed to bind it raw, so the workspace pins `ndk` 0.9.0 to a vendored copy (clients/android/native/ vendor/ndk) whose ONLY change makes MediaCodec::as_ptr public — the "as_ptr patch". Workspace-excluded so host builds never compile it; drop when upstream exposes either. - nativeVideoStats grows to 26 doubles (22–25: dispValid, displayP50, e2eDispP50/P95; 0–21 unchanged for older readers); StatsOverlay moves headline endpoint + equation together so the equation always tiles the headline interval. Verified: host cargo check/test/clippy, aarch64-linux-android check/clippy, Kotlin app+kit+tests compile, roborazzi HUD render shows the full 4-term equation. Device verification rides plan 4.2's phone A/B. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 11:35:16 +02:00
enricobuehler	f508d3213f	polish(clients/windows): name the session exe "Punktfunk Session" in its version info ... UAC prompts, Task Manager and Properties→Details show FileDescription; without one the exe appeared as its raw filename. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 10:57:41 +02:00
enricobuehler	a69a83b545	feat(clients/windows): D3D11VA hardware decode in the session client — Vulkan chain becomes vulkan → d3d11va → software ... The vendor-agnostic DXVA path for GPUs without Vulkan Video (Intel's Windows driver foremost, which previously landed on CPU decode). Ported from the retired WinUI presenter's decoder with its Intel-safe discipline intact (decode pool stays libavcodec-derived — a hand-built pool broke Intel at the first SubmitDecoderBuffers), on a decode device LUID-matched to the presenter's adapter. Hand-off is a ring of shareable BGRA8 textures (SHARED_NTHANDLE | SHARED_KEYEDMUTEX) filled by the fixed-function ID3D11VideoProcessor (NV12/P010 → BGRA8, colour spaces from the per-frame CICP; PQ is tone-mapped to SDR by the processor — HDR-first boxes take Vulkan Video). BGRA is deliberate: importing a multiplanar NV12 D3D11 texture device-losts on NVIDIA however it is consumed (plane-view sampling and DMA copy both validation-clean, both TDR — bisected), while single-plane RGBA D3D11↔Vulkan interop is the path Chromium/ANGLE exercise on every driver. The presenter imports a slot's NT handle per frame (VK_KHR_external_memory_win32, gated on the spec-required external-format probe) and blits it into the video image — no CSC pass; the DXGI keyed mutex (key 0 both sides, drop-tolerant) is the cross-API lock and visibility barrier. Verified live vs a real host at 5120x1440@240 HEVC on an RTX 4090: 240 fps, e2e 2.7/3.0 ms p50/p95 under the Khronos validation layer — parity with Vulkan Video (2.6 ms); auto still resolves vulkan on NVIDIA. PUNKTFUNK_DECODER=d3d11va forces it; import/present failures demote to software on the existing streak contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 10:57:41 +02:00
enricobuehler	d0fa8bd3ee	fix(clients): pin mDNS discovery to IPv4 on every client ... Host machines' OS mDNS responders answer AAAA for hostname.local even though the punktfunk stack binds IPv4 sockets exclusively, so a v6-resolved address rendered a host card whose connect always failed. Apple's Network.framework prefers IPv6 (RFC 6724) — force the resolve connection to v4; pf-client-core (Linux/Windows/Deck shells) now picks get_addresses_v4() instead of an arbitrary first address. Android already did exactly this, for the same reason. Lift all three when the stack actually speaks IPv6 (per-family shard sizing is the gating item — the IPv6 header costs 20 bytes of the MTU budget shard_payload is maximal against). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 10:57:41 +02:00
enricobuehler	8e6e8bb25c	feat(core,host): adaptive bitrate — mid-stream encoder re-targeting when set to Automatic ... New SetBitrate (0x05) / BitrateChanged (0x06) control messages: the host clamps like the Hello request, acks the resolved rate, and rebuilds the ENCODER ONLY in place (same mode, first new-rate frame is an IDR — the proven mode-switch resync, minus the pipeline churn). The client side is an AIMD controller (core abr.rs) in the data-plane pump, armed only when the user's bitrate is Automatic (Hello bitrate_kbps == 0): ×0.7 after two bad 750 ms windows (FEC-unrecoverable frames, ≥2% loss, one-way-delay rise above its rolling baseline — the pre-loss bufferbloat signal off the clock-skew handshake — or a jump-to-live flush), ~+6% after ~10 s clean, ceiling = the session's starting rate, 3 s cooldown, self-disables against a host that never acks (older build). Division of labour: adaptive FEC keeps answering fast random loss; bitrate now answers persistent congestion, closing the FEC death-spiral gap. The web-console sample reports the live rate. Also: join_host_port() brackets bare IPv6 literals before SocketAddr parsing (parse-side IPv6 groundwork, pairs with the next commit). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 10:57:41 +02:00
enricobuehler	180ac3aa61	feat(console): full gamepad shell — hosts, PIN pairing, settings, OSK, screen transitions ... The Skia console UI grows from the single library coverflow into a complete couch shell (Apple gamepad-UI parity), so a Deck/gamescope session is self-sufficient end to end: - Home: host carousel (saved + discovered + Add Host tile) with presence pips, paired locks, wake & connect; A/Y/X/B per the Apple launcher. - In-console SPAKE2 PIN pairing (previously needed the Decky plugin or a desktop), add-host with a controller keyboard, couch settings over the shared Settings store, wake-on-LAN overlay with retry, cancelable dials. - Shell chrome: screen stack with push/pop entrance/exit choreography (slide + fade + recede; aurora↔form backdrop crossfade), per-pad button glyphs (PS shapes vs ABXY, keycaps with no pad), menu haptics, toasts, embedded Geist typography, in-stream start banner. - Steam Deck: our OSK never draws — fields start SDL text input (the new Overlay::text_input_active hook) and Steam's keyboard types; a hint chip points at STEAM + X. Other Linux gets the full gamepad keyboard tray. - punktfunk-session: bare --browse opens Home; --browse host opens that host's library with Home behind it (Decky launches keep working, B now pops instead of quitting). Service threads run discovery, 10 s probes, pairing, wake loops, fetches, and known-hosts persistence. - Presenter contract: Launch actions carry the host, CancelConnect never engages a won race, pad kind/list ride FrameCtx, menu events flow while dialing so B can cancel. Every screen renders to PNG on CPU raster for review (PF_CONSOLE_DUMP=<dir> cargo test -p pf-console-ui -- --ignored dump). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 08:46:49 +02:00
enricobuehler	c3fa6c1514	feat(clients/apple): AV1 decode support — OBU plumbing, hardware-gated advertisement ... The Apple client was HEVC/H.264-only: the receive path spoke Annex-B NALs exclusively, so AV1 was never advertised and the codec picker hid it. Add the OBU flavor of the same plumbing (AV1.swift, sibling of AnnexB.swift): a zero-copy OBU walker, a full spec-5.5.1 sequence-header parser, an av1C CMVideoFormatDescription with colorimetry extensions (so isHDRFormat and the presenter stay codec-agnostic), and an ISOBMFF 'av01' sample repack (temporal delimiter stripped, everything size-fielded, one copy per AU). VideoCodec gains .av1 (wire 0x04); both pumps and VideoDecoder route through dispatching formatDescription(fromKeyframe:)/sampleBuffer(au:) — keyframe gating keys on the in-band sequence header exactly as the NAL codecs key on in-band parameter sets, so loss recovery and mid-session reconfigure work unchanged. AV1 sessions require a hardware decoder (VideoToolbox has no software AV1; same fail-fast policy as 4:4:4), and both the Hello advertisement and the Settings picker are gated on VTIsHardwareDecodeSupported — AV1 only appears on devices that can actually decode it (M3-class Macs, A17 Pro-class iPhones; no Apple TV). Tests: real SVT-AV1 blobs (generation recipe in the file) cover the walk, the parse against an independent reference, av1C bytes, delta-TU gating, repack byte-exactness, and — on AV1 hardware — a real VTDecompressionSession decode through VideoDecoder. Host precedence stays HEVC > AV1 > H.264, so AV1 engages only when explicitly picked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 01:22:56 +02:00
enricobuehler	bf9be59f0b	feat(clients/windows): rename the Help button to Shortcuts ... "Shortcuts" says what the page actually is — the in-stream keyboard/controller reference — and the keyboard glyph reads better than the generic help icon (user feedback from the live-test round). Page title follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 01:07:03 +02:00
enricobuehler	a3332aedae	fix(clients/apple): return to windowed after a stream error, not just an active disconnect ... A session error tears down the same as a deliberate disconnect (connection → nil flips FullscreenController's `active` off), but ALSO sets `errorMessage`, raising the "Connection failed" alert. On macOS that alert is a window sheet, and AppKit drops `-toggleFullScreen:` while a sheet is attached — so the exit was swallowed and the window stayed fullscreen on the home screen (an active disconnect sets no error, so it never stuck). Defer the alert while a forced-fullscreen exit is pending: no sheet attaches during the exit, the window returns to windowed, then the alert presents over it. Not gated when fullscreen is the user's own manual choice (opt-out setting), where nothing is auto-exiting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 00:47:15 +02:00
enricobuehler	069fcdfca6	feat(clients/apple): user-configurable Allow VRR (macOS + iOS) ... Add an "Allow VRR" toggle (Settings → Display; default on, non-tvOS) that hands the presenter's display link a wide frame-rate RANGE — preferred = the stream rate — so a ProMotion / adaptive-sync display can vary its physical refresh to match the stream. `SessionPresenter.syncFrameRate` now runs on macOS too: on it requests min 24 / max display / preferred stream Hz; off restores the prior behavior (macOS free-runs at the native rate, iOS keeps its 30 Hz floor). A no-op on fixed-refresh displays. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 00:47:15 +02:00
enricobuehler	f58d91ba19	polish(clients/apple): tighten settings copy, fix stale ⌃⌥⇧S shortcut ... The Statistics footer still advertised the old ⌘⇧S toggle after the cross-client shortcut migration — corrected to ⌃⌥⇧S (StreamCommands). Split the Audio footer into a platform-aware string (the "System default follows device changes" note only applies to macOS, where the device pickers live). Trim the overloaded Video-quality, Controllers, gamepad-UI, touch/pointer, presenter and library footers to the load-bearing facts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 00:47:15 +02:00
enricobuehler	f4850625bd	feat(clients/windows): game library page + session window placement + help polish ... UX polish batch 2 (plan workstreams D/E5/E6): - D: a mouse/keyboard game library page over pf-client-core::library (the GTK ui_library.rs counterpart): responsive 2-6 column poster grid (2:3 portraits, store badge, monogram placeholder while art streams in), loading / error+retry / empty / grid states, tap-to-play via a normal spawn carrying --launch id. Poster bytes land in a disk cache (%LOCALAPPDATA%\punktfunk\art-cache) so the Image widget loads file:/// URIs (reactor has no from-bytes source) and revisits render instantly. Reached from a paired host's "Browse library..." menu item behind the new "Show game library (experimental)" Settings toggle (the shared library_enabled field, Apple/GTK parity). A Shared::library_gen generation guard keeps a superseded fetch from publishing (speed-test pattern). - E5: the session window opens at the shell's own top-left (--window-pos, new SessionOpts::window_pos) instead of centered on the primary display - streams land on the monitor the shell is on, and the hide/restore handoff reads as one window changing content. Fullscreen follows that display. - E6: the Help shortcuts add Alt+Enter and the controller escape chord (LB+RB+Start+Back, hold to disconnect). Also: rustfmt normalization of the merged probe helper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 00:43:46 +02:00
enricobuehler	f5f186b691	Merge remote-tracking branch 'origin/main' ... # Conflicts: # clients/windows/src/app/mod.rs	2026-07-09 00:28:38 +02:00
enricobuehler	573b2af334	feat(clients/windows): single-window handoff, shared settings store, console-UI surfacing ... UX polish batch 1 (clients/windows/ui-polish-plan.md, workstreams W0/A1/B/C/E): - W0: the shell's duplicated trust/settings structs are gone — src/trust.rs re-exports pf-client-core's, so the shell and the spawned session binary share ONE Settings shape over client-windows-settings.json. Fixes real bugs: the shell's saves no longer drop session-side fields; the stats-overlay toggle (show_hud -> show_stats, serde alias migrates old files) and the forwarded- controller pick now actually reach the spawned session. The "Streaming engine" Settings combo is gone (PUNKTFUNK_BUILTIN_STREAM=1 stays as the dev A/B knob). - Forwarded-controller pinning by stable key (vid:pid:name, pf-client-core's format): persisted as forward_pad, applied by the shell's own service at startup AND by the session binary in session_params (both OSes — the session never applied the pin before). - A1 single window: the shell hides itself when the spawned session window presents its first frame ({"ready":true}) and restores + foregrounds on the child's exit — exactly one visible Punktfunk window at any time. Restore runs before the request-access cancel gate so a Ready/Cancel race can't strand the shell hidden. - C console UI: punktfunk-session --browse gains --json-status (ready when the library window presents; error line on a failed start), and the shell surfaces it — "Open console UI" on paired hosts' menus, plus a controller- detected hint card targeting the most recent paired host (x64 only; aarch64 ships no skia ui feature). Browse spawns hide/restore the shell like streams. - B responsive: minimum window size (420x360); the hosts header collapses to icon-only buttons below 700 px; the session status card shrinks instead of clipping (max_width); busy pages, help actions, licenses and long labels wrap. - E polish: session exe gets the app icon (winresource + WM_SETICON via the new pf-presenter win32.rs); both exes share an explicit AppUserModelID on unpackaged runs (packaged identity wins) so the windows group as one taskbar app across the visibility handoff; "Start streams fullscreen" toggle passes --fullscreen (GTK parity); connects stamp KnownHost::last_used; the connect target is stashed for every route so "Connecting to X" always names the host. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-09 00:25:02 +02:00
enricobuehler	01428ced58	feat(clients): reachability-probed presence + shareable Decky host management ... Add a bounded, trust-agnostic, mDNS-INDEPENDENT QUIC reachability probe and surface it everywhere saved-host presence is shown, so a host reached over a routed network (Tailscale/VPN/multicast-filtering LAN) no longer reads Offline just because it isn't advertising — the display-side companion to the 0.8.4 dial-first connect fix. Core: - punktfunk-core: NativeClient::probe (bounded handshake; a real host answers even on trust mismatch, a wrong/closed/TCP-only port fails) + punktfunk_probe C ABI (ABI_VERSION 3->4, header regenerated). - pf-client-core: trust::probe_reachable_many (parallel per-host sweep). Presence pips now read `advertising OR probed-reachable`, refreshed by a ~10-12s background sweep off the UI thread: - Linux (relm4): ui_hosts probed map + HostsMsg::Probed sweep. - Windows (windows-reactor): pf-probe worker -> HostsProps.probed. - Apple (SwiftUI): HostStore.refreshReachability, driven by HomeView + GamepadHomeView .task. - Android (Compose): nativeProbe JNI seam + periodic LaunchedEffect (LNP-gated), online dot added to the touch HostCard. - Decky already probes via --list-hosts --probe. Decky client: make the flatpak client's known-hosts store the single source of truth via new headless CLI modes (--list-hosts / --add-host / --set-host / --forget-host / --reset / --reachable). The plugin can now add a host by address, edit/forget hosts, reset all state (keeping the client identity), and shows probe-backed online pips — state is shared with the desktop client, not duplicated. Also lands in-progress Android 17 LNP groundwork (targetSdk 37 + ACCESS_LOCAL_NETWORK runtime flow, permission dialogs) that was already present in the working tree. Verified: cargo check + clippy clean (punktfunk-core, pf-client-core, linux, android native); android assembleDebug BUILD SUCCESSFUL; decky typecheck + rollup build clean; probe true/false-positive behaviour exercised against a live host. Windows and Apple were not compiled locally (no MSVC/Xcode on this Linux box). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-09 00:14:56 +02:00
enricobuehler	6198da3daf	feat(clients/apple): cross-client shortcuts + start banner, opt-in V-Sync, presenter rework ... Align the macOS/iPad Stream menu on the cross-client Ctrl+Alt+Shift set the Windows and Linux clients reserve — Release Mouse (⌃⌥⇧Q), Disconnect (⌃⌥⇧D), HUD toggle (⌃⌥⇧S) — with ⌘⎋ kept as the macOS/iPad capture toggle, and surface them on a 6-second banner at stream start. Add an opt-in V-Sync present mode (punktfunk.vsync, default OFF = lowest-latency immediate present; PUNKTFUNK_PRESENT_MODE overrides for A/B), with the presenter reworked to a frame-arrival-triggered render thread across Stage2Pipeline / MetalVideoPresenter / SessionPresenter, plus the windowed title-bar safe-area handling. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 00:12:02 +02:00
enricobuehler	c511462536	feat(clients/apple): enable Game Mode across Apple platforms ... Opt macOS and iOS into system Game Mode (GCSupportsGameMode=YES) and unify the App Store category to Games across macOS/iOS/tvOS (tvOS omits the key — no Game Mode there). Game Mode engages automatically when the stream is native-fullscreen (already the default), giving GPU/CPU priority and doubling controller/AirPods Bluetooth polling for lower input/audio latency — parity with the Android client's appCategory=game. Verified: macOS/iOS/tvOS Debug builds succeed and the produced bundle Info.plists carry the expected keys. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-09 00:11:54 +02:00
enricobuehler	d6647b9183	feat(clients/windows): port the Vulkan session client to Windows — session-always ... The punktfunk-session Vulkan client (clients/linux-session, now clients/session) builds and runs on Windows; the WinUI shell spawns it for every stream. Verified live: 10-bit HEVC via Vulkan Video on both AMD (iGPU) and NVIDIA, 5120x1440 at 130 fps / 8 ms end-to-end on the RTX 4090. - pf-ffvk: Windows bindgen branch (FFMPEG_DIR + PF_FFVK_VULKAN_INCLUDE, no pkg-config); provisioning fetches Vulkan-Headers (pinned v1.4.309). - pf-client-core: builds on Windows — WASAPI audio (audio_wasapi.rs, cfg-swapped via #[path], same surface as the PipeWire twin), VAAPI/dmabuf gated inline (chain = vulkan -> software), trust reads the WinUI shell's %APPDATA% stores (parity tests pin both serialized shapes), Settings gains adapter/hdr_enabled (serde-defaulted; Linux stores unaffected). - pf-presenter: builds on Windows — dmabuf module Linux-gated; SDL keyboard grab while captured (Alt+Tab/Win reach the host); pick_device ranks discrete over integrated (device 0 was the iGPU on hybrid boxes — the silent footgun) and honors PUNKTFUNK_VK_ADAPTER (the Settings GPU pick, exported by the session). - run loop: block in one SDL wait woken by input AND decoded frames (a per- session forwarder pushes a FrameWake user event) instead of a 1 ms poll — measured 111%% -> 5%% of a core (NVIDIA), 86%% -> 3.5%% (AMD), stats unchanged. The pump's decode-fence wait became once-per-window sampling (no per-frame pipeline stall; the stat now shows true backlog). - pf-console-ui: builds on Windows (skia-safe msvc prebuilts); font lookup falls through fontconfig aliases to concrete DirectWrite families (Consolas/Segoe UI) — browse/coverflow works, verified against a live host. - WinUI shell: session-always via new src/spawn.rs (GTK spawn.rs port — CREATE_NO_WINDOW, stdout contract, kill handle); the Stream screen is a status card (chips + stage lines from the child's stats). The legacy in-process D3D11VA path stays behind Settings "Streaming engine" / PUNKTFUNK_BUILTIN_ STREAM=1 as the A/B baseline until Phase 8 deletes it. SessionParams.video_caps makes the HDR toggle real. - clients/linux-session renamed to clients/session (builds for both OSes). - CI/MSIX: both workflows build/test both bins with widened path filters; the MSIX ships punktfunk-session.exe. ARM64 session builds --no-default-features (rust-skia has no aarch64-pc-windows-msvc prebuilts; flip when it does). A/B on this box (5120x1440 HEVC vs home-worker-5): NVIDIA Vulkan 130 fps / 8 ms e2e / 1.6 ms decode — clearly better than the built-in path. The AMD iGPU VCN saturates at ~52 fps where its own D3D11VA does ~70 — Adrenalin Vulkan decode is slower on APU silicon; discrete RDNA validation gates Phase 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 23:21:36 +02:00
enricobuehler	2003d8a75c	style(host): rustfmt the bit_depth ternary in serve_session ... Collapse the manually-wrapped if/else to rustfmt's canonical form; fixes the cargo fmt --all --check CI failure at punktfunk1.rs:895. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 22:07:54 +02:00
enricobuehler	838a1239cf	feat(codec): make client codec selection real — GPU-aware native advertisement ... The clients' codec pickers sent a preference the host threw away: host_wire_caps() hardcoded HEVC for every GPU backend, so the native path never emitted H.264/AV1 regardless of what the user chose. Host: advertise what the backend actually encodes, mirroring the GameStream serverinfo logic — software openh264 emits H.264; probed backends (Linux VAAPI, Windows AMF/QSV) advertise their per-GPU CodecSupport via the new wire_mask(); NVENC keeps the Moonlight-validated H.264|HEVC|AV1 static superset; an empty probe falls back to the superset so auto clients still resolve HEVC. Gate 10-bit to HEVC (like the 4:4:4 gate) now that a client can steer the codec — Main10 is the only 10-bit encode path. Fix the web-console stats label hardcoded to "hevc" (new Codec::label(), shared with the GameStream register_session mapping). Android: replace the hardcoded H264|HEVC Hello advertisement with a videoCodecs param fed by VideoDecoders.decodableCodecBits() (AV1 bit only when a real hardware video/av01 decoder exists — the decode loop was already mime-driven); offer AV1 in the codec picker on capable devices. Decky: add the missing "Video codec" dropdown (auto/hevc/h264/av1) to the plugin settings, round-tripping the same codec key the flatpak client reads. Apple: unchanged by design (AnnexB.swift is NAL-only, AV1 is never advertised); refresh the stale "hosts don't emit AV1 on the native path yet" comments here and host-side. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 16:45:37 +02:00
enricobuehler	0290bf7285	fix(clients/windows): hide the local cursor while captured ... set_locked() hid the OS cursor with a one-shot ShowCursor(false), but the WinUI content island answers WM_SETCURSOR and re-asserts the arrow on every pointer move, so the cursor reappeared the instant the mouse moved while the pointer lock was engaged. A low-level mouse hook never sees WM_SETCURSOR, so it couldn't suppress it. Subclass the WinUI window and all its descendants (the video is a composition SwapChainPanel, so the pointer actually sits over WinUI's internal input-site child, which is the window that receives WM_SETCURSOR) and, while the lock wants the cursor hidden, answer WM_SETCURSOR ourselves with SetCursor(None) and return TRUE — halting WinUI's arrow re-assertion. ShowCursor(false) stays as the coarse first-frame hide. The subclass is removed on teardown so the reused app window (host list) is left pristine. Adds the Win32_UI_Shell feature for the subclassing APIs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 16:45:20 +02:00
enricobuehler	e28160ebb3	chore(release): bump workspace version to 0.8.4 ... Release 0.8.4 — reconnect reliability and streaming polish over 0.8.3. The headline fix: a reconnect to a saved host that had stopped advertising on mDNS (but still had a learned Wake-on-LAN MAC) was routed into a wait-for-mDNS wake flow instead of being dialed — so a host reached over a routed network (Tailscale/VPN/another subnet) could never be reconnected, reading as "Offline" with no connection attempt in the host log. All four full clients now dial first and only fall into the visible "Waking…" wait when the dial actually fails. On the host side, the same investigation surfaced Windows-only gaps: a deliberate quit (⌘D) now tears the pf-vdisplay virtual monitor down immediately (no 10 s linger churning the reconnect's REMOVE→ADD), while keep_alive=forever (the gaming-rig preset) correctly outranks the quit on both platforms so a pinned screen stays alive. Silent deaths are no longer invisible: a panic hook tees panics into the web console's Logs, a Windows SEH filter names the faulting module on a native GPU-driver crash, and a watchdog flags a wedged monitor teardown. Also in this release: the presenter switches to MAILBOX present, pushes HDR10 mastering metadata, and tags HDR honestly; DualSense rumble accepts the v2 vibration valid-flag and bounds a stale buzz; the core caps the QUIC datagram send buffer so audio/rumble go latest-wins; the host folds a Steam Deck to a DualSense on Windows (split-pad touch + pad clicks) and applies input motion on arrival rather than after the 4 ms tick; Android gains a tiered stats HUD with windowed lost/skipped/FEC counters; and Windows surfaces a Help/shortcuts screen and exits fullscreen when the stream stops. The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; the 14 workspace entries in Cargo.lock and the api/openapi.json info.version are refreshed to match (CI builds --locked). Canary derives from the tag as minor+1 of the latest stable (scripts/ci/pf-version.sh), so cutting 0.8.4 keeps canary at 0.9.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> v0.8.4	2026-07-08 14:17:01 +02:00
enricobuehler	0b7e4a00ee	fix(host): crash visibility + Windows deliberate-quit teardown; pin outranks quit ... Two strands from the "Windows host went Offline after reconnect, zero errors in the logs" investigation. Crash visibility — the field reports kept arriving with nothing in the Logs tab because every way the host can die silently was unlogged: - A panic hook tees each panic (thread, location, backtrace) through `tracing` into the in-memory ring + host.log before the default hook runs — a panicking thread otherwise only hit stderr, absent from the web console and gone when stderr is detached. - A last-resort Windows SEH filter (windows/crash.rs) logs an unhandled native exception with its code, faulting address, and faulting MODULE — the smoking gun that separates our bug from a GPU runtime/driver DLL (amfrt64, the UMD, d3d11) crashing under us. - A 10 s watchdog around the vdisplay monitor teardown logs an ERROR when the driver REMOVE/CCD-restore looks wedged (it runs under the manager state lock, so a hang there silently blocks every future acquire). Deliberate-quit teardown (Windows pf-vdisplay) — the Windows manager never wired the linger skip the Linux registry has: on ⌘D (the QUIT close code) the monitor lingered 10 s, so a quick reconnect hit the Lingering-preempt's back-to-back REMOVE→ADD churn. A per-lease quit flag (VirtualDisplay:: set_quit_flag) now tears the monitor down immediately on a deliberate quit, so the reconnect finds the manager Idle and does a clean fresh ADD. Pin outranks quit (both platforms) — keep_alive=forever (the gaming-rig preset) promises "the screen stays alive", so a deliberate quit must skip only the linger WINDOW, never the pin. Windows release() checks keep_alive_forever() before the quit; the Linux registry had the inverse bug (force_immediate tore down even a pinned display) — fixed via effective_linger() with a unit test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 14:17:01 +02:00
enricobuehler	ab6790ef6c	fix(clients): dial-first reconnect — don't gate the connect on mDNS presence ... A saved host that stopped advertising on mDNS but has a learned Wake-on-LAN MAC was routed into a wake-and-WAIT-for-mDNS flow instead of being dialed. For a host reached over a routed network (Tailscale/VPN/another subnet) mDNS never sees it, so the wait could never succeed and reconnects were impossible — the host log showed no connection attempt at all. The tile's Offline pip and this connect gate shared the same LAN-only `advertises`/`liveAdvert` predicate, so a perfectly reachable host read as unreachable. The first connect worked only because the MAC hadn't been learned yet (a direct dial); once learned, every reconnect wedged in the waker. All four full clients carried this pattern (deliberate mirrors of the Apple `HostWaker`). Each now DIALS FIRST: fire the magic packet up front (fire-and-forget — harmless if the host is awake, and a genuinely-asleep box is booting while the dial times out) and attempt the connection unconditionally. Only a FAILED dial falls into the visible "Waking…" wait, whose redial carries no fallback so it can't loop. A fingerprint-mismatch/trust-rejection failure means the host ANSWERED, so it never takes the wake path. - apple: SessionModel.connect gains `onUnreachable`; startSession dials first. - linux (relm4): AppMsg::WakeConnect wakes+dials; a per-request wake_fallback is armed and consumed in SessionExited, matched by fingerprint/address. - windows: initiate_waking + ConnectOpts.wake_on_fail; the worker's Failed arm escalates to wake_and_connect only on a non-trust failure. - android: doConnectDirect gains onFailure; doConnect wakes+dials first. Decky was already correct (always launches `--connect`; WoL fire-and-forget). Explicit "Wake host" menu actions are unchanged — waiting on mDNS is right when the user explicitly asked to wake a box. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-08 14:17:01 +02:00
enricobuehler	52856d4b6b	chore(web): refresh bun.lock ... Dependency bumps within the existing package.json semver ranges; no manifest changes.	2026-07-08 13:12:01 +02:00
enricobuehler	6bbd2a9ed6	feat(windows): add deploy-all.ps1 wrapper; fix web console health check ... deploy-all.ps1 chains deploy-host.ps1 + build-web.ps1 so a full redeploy is one command; stops before the web step if the host build/start fails. build-web.ps1's post-restart check was probing http:// while web-run.cmd serves HTTPS-only, so it always reported a false failure - probe https via curl.exe (no -SkipCertificateCheck on the Windows PowerShell 5.1 this runs under) with a short retry loop for the task's cold start instead.	2026-07-08 13:11:59 +02:00
enricobuehler	ade4266336	fix(presenter): MAILBOX present; push HDR10 metadata; honest HDR tag ... Three Deck-test findings in the Vulkan presenter: MAILBOX over FIFO when the surface offers it (PUNKTFUNK_PRESENT_MODE= fifo restores the old default): both are tear-free, but an arrival- paced presenter blocking in FIFO's present queue eats most of a vblank whenever gamescope holds images for its composite pass or cadence drifts against refresh — the display stat flipping 1 ms → 11-13 ms. VK_EXT_hdr_metadata wired up: the host's 0xCE mastering metadata (or the Windows presenter's generic HDR10 baseline until it arrives) is pushed via vkSetHdrMetadataEXT whenever an HDR10 swapchain is (re)- created. Compositors key their HDR-app signaling on this — colorspace alone leaves gamescope treating the app as SDR (no SteamOS badge). And the OSD's HDR tag now reports the display path, not the stream: a PQ stream tone-mapped onto an SDR surface shows HDR→SDR, so the next test distinguishes "badge missing" from "HDR never engaged". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 12:29:56 +02:00
enricobuehler	dc834ea478	fix(rumble): accept the v2 vibration valid-flag; bound stale buzz to 1.5 s ... Two hardenings against runaway vibration (one Deck session buzzed on a ~2 s cadence): the DualSense output-report parse now also treats valid_flag2 COMPATIBLE_VIBRATION2 (data[39] BIT2) as rumble-carrying — a writer hardcoding the ≥2.24-firmware convention previously had its rumble INCLUDING stops silently ignored, and a missed stop re-sends stale nonzero state forever via the host's 500 ms refresh. And the client's SDL rumble duration drops 5 s → 1.5 s: long enough that a couple of lost 500 ms refreshes don't gap genuine rumble, short enough that stale state dies on its own. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 12:29:56 +02:00
enricobuehler	4516bd48e1	perf(core): cap the QUIC datagram send buffer — audio/rumble go latest-wins ... quinn's default 1 MiB datagram FIFO holds tens of seconds of Opus; on a congested link the audio/rumble/input planes built a standing delay that never drained while video (own latest-wins UDP path) stayed live — observed on the Deck as audio and rumble lagging together by the same experience-destroying amount. quinn sheds oldest-first at the cap, so a 4 KiB bound makes the plane latest-wins at the source: ~200 ms of stereo Opus worst case, and sustained congestion costs concealable drops instead of lag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 12:29:56 +02:00
enricobuehler	4c9c7e606e	feat(android): tiered stats HUD + windowed lost/skipped/FEC counters ... Stats overlay verbosity tiers (Off/Compact/Normal/Detailed, 3-finger tap cycles live, old Boolean pref migrated) and the unified-spec line-4 reliability counters: lost/FEC windowed from the connector's cumulative totals, skipped from the client's own newest-wins drops. Adds the fec_recovered_shards accessor to NativeClient, mirrored from the data-plane pump like frames_dropped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 12:29:56 +02:00
enricobuehler	b12c7d3deb	style(windows): satisfy rustfmt on the uninstall() teardown comments ... rustfmt 1.9.0 aligns standalone // lines out to the column of a preceding trailing comment, so the two-line fullscreen note placed right after `set_captured(...); // ...` failed `cargo fmt --check`. Make the first note a leading comment so no standalone comment follows a trailing one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 11:24:42 +02:00
enricobuehler	8a4b0c7bae	feat(windows): surface shortcuts on a Help screen; exit fullscreen when the stream stops ... The in-stream keyboard shortcuts were only reachable deep in Settings > Input. Move them to a dedicated Help screen reached from a Help button on the host list (mirrors the Licenses screen — a hook-free page routed from root), and drop the reference card out of Settings so there's one home for it. Fullscreen (F11) was a window-style toggle that stream stop never undid, so disconnecting while fullscreen left the GUI borderless-fullscreen. Split toggle_fullscreen into is_fullscreen/enter_fullscreen/exit_fullscreen sharing a module-level SAVED_PLACEMENT, and have input::uninstall() call exit_fullscreen() on teardown. exit_fullscreen is a no-op when nothing was saved, so it's safe on every stream stop and idempotent with F11 — fullscreen is now streaming-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 11:17:19 +02:00
enricobuehler	d490397908	chore: gitignore the local flatpak-builder repo/build dirs ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:51:26 +02:00
enricobuehler	a41f679516	perf(host): one input channel — motion applies on arrival, not after the 4 ms tick ... Rich input (gyro at the pad's report rate, trackpad contacts) rode a second mpsc channel that the input thread only drained after its main channel's 4 ms recv timeout — so during pure-gyro aiming (no button/pointer traffic, the common case) every motion sample ate up to 4 ms of added latency and quantization before reaching the virtual pad. At the Deck's 250 Hz sensor cadence that is a full sample period of jitter. Both planes now share one ClientInput channel: the thread wakes the moment either arrives and applies rich input immediately. The 4 ms timeout stays as the feedback-pump tick. Also adds a debug-level motion-cadence metric (inter-arrival p50/p95/max per 5 s window) so gyro delivery is measurable end-to-end instead of 'feels floaty'. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:51:04 +02:00
enricobuehler	e6d9454251	feat(host): fold Steam Deck to DualSense on Windows; split-pad touch + pad clicks ... A Deck client asking for 'steamdeck' on a Windows host resolved to Xbox360, whose apply_rich is a no-op — gyro and both trackpads silently discarded. Windows already ships a full DualSense backend (UMDF driver, touchpad + motion, wire units 1:1), so pick_gamepad now folds SteamDeck -> DualSense there. The three near-identical DualSense-family appliers (Linux UHID, Windows DualSense, Windows DS4) are hoisted into one shared dualsense_proto::DsState::apply_rich, with two mapping upgrades for Steam dual-pad clients everywhere: * the Deck's two pads SPLIT the single DualSense touchpad — left pad -> contact 0 on the left half, right pad -> contact 1 on the right half — mirroring the physical thumb layout and the split-pad zones games and Steam Input already use (the left pad was previously dropped outright) * TouchpadEx pad clicks now press the touchpad-click button (persisted in DsState::touch_click, OR-ed in by both serializers; previously dropped by every DualSense-family backend, Linux included) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:50:53 +02:00
enricobuehler	9ca672d434	fix(host): trackpad Y rides the wire in screen convention, flips at the Deck boundary ... Both Deck trackpads were inverted on the virtual pad (first live Deck-to-Deck session): the client sends SDL's screen-convention coordinates (+y down) onto the wire, but the Deck's raw report fields are stick convention (+y up) — and Steam Input parses our report as real Deck hardware — while the host applier passed the value straight through. Pin the wire meaning down (quic.rs: TouchpadEx/Touchpad are screen convention, +x right +y down — what every client capture API produces) and translate to device-raw in the host applier, the layer that knows the quirk: steam_proto's apply_rich now negates y (saturating: -32768 has no i16 negation) for both TouchpadEx surfaces and the DualSense-standin Touchpad arm, which carried the same latent inversion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:50:30 +02:00
enricobuehler	b8fd652cb8	fix(packaging): autoload vhci-hcd and open its attach files for the usbip Deck pad ... Steam Input only adopts the virtual Steam Deck controller when it arrives as a real USB device (raw_gadget or usbip/vhci transports); the UHID fallback has no USB interface and Steam ignores it. On a stock host neither precondition for usbip held: vhci-hcd isn't loaded, and its sysfs attach/detach files are root-only while the host runs as a user service — so every session silently fell back to UHID and 'no controller appears on the host' (live-debugged 2026-07-08: client events all arrived, the pad existed, Steam just refused it). Ship both preconditions with the host packages: * modules-load.d/punktfunk.conf loads vhci-hcd at boot (rpm/deb/arch; Bazzite gets it via the RPM payload + a modprobe in the sysext post-merge hook) * a udev rule in 60-punktfunk.rules grants the input group write on vhci_hcd's attach/detach whenever the device appears Verified end-to-end on a live host: usbip in-process attach, hid-steam binds all three interfaces, 'Steam Deck' + motion evdev appear, and Steam adopts the pad (client-mode grab + its own virtual X360 emission). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:50:19 +02:00
enricobuehler	5042ffd935	fix(presenter): order the vk-frame layout transition after the decode semaphore ... The submit waits the Vulkan-Video frame's decode-complete timeline semaphore at FRAGMENT_SHADER, but the acquire barrier ran its layout transition (VIDEO_DECODE_DST/DPB -> SHADER_READ_ONLY) from srcStage TOP_OF_PIPE — which the wait does not cover, so no dependency chain formed and the transition could execute while the decode queue was still writing the image. The race window is real: the pump ships each frame to the presenter BEFORE its decode-complete wait (that wait is stats-only). On RADV the transition physically touches the image (metadata / decompression), so the race rendered green/yellow block corruption exactly at freshly-decoded regions — the Steam Deck 'artifacts around the moving cursor' bug (the cursor is the only damage on an idle desktop). NVIDIA treats the transition as a no-op, which is why the identical code looked clean on the dev box. srcStage is now FRAGMENT_SHADER, matching the semaphore's wait mask — the standard acquire pattern (same as swapchain acquires) that chains the transition after the decode signal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:50:06 +02:00
enricobuehler	8bef4e27f9	fix(client-linux): opt into RADV Vulkan Video decode at session start ... Mesa gates RADV's video-decode support — the VK_KHR_video_decode_* device extensions AND the decode-capable queue family — behind RADV_PERFTEST=video_decode (Steam Deck / VANGOGH included). Without it the presenter's device advertises no decode queue, Decoder::new's auto chain skips Vulkan Video, and the session silently lands on VAAPI. punktfunk-session now appends the token to RADV_PERFTEST before the driver loads (all streams run through this binary, so every launch path and package is covered). RADV-only knob: other drivers ignore it, and a Mesa where decode is already default just no-ops. Verified on the Deck: decode_qf=2, H264/H265/AV1 caps, first frame path="vulkan-video", 90 fps at 1.9 ms decode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 10:49:51 +02:00
enricobuehler	b664ae373d	fix(screenshots): give PF_SHOT_READY headroom for the cold first scene ... The linux-client-screenshots job red-lit on a single scene — the first one (`hosts`) — with "client never signalled PF_SHOT_READY", while the other six captured fine (~1-2s each). Root cause: the first client launch pays a large one-time cold-start under software rendering (llvmpipe GL-shader + fontconfig cache build, plus first-run client-identity generation into the shared scratch HOME), ~25s on the CI runner; the relm4 shell rebuilt in 0.8.3 tipped it just over the 20s PF_SHOT_READY cap. Every scene rendered correctly — the cap was simply too tight for cold start. Raise it to ~60s (warm scenes still break out in ~1-2s, so the happy path is unchanged). Best-effort job; it never blocked the release, but now it goes green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 08:30:58 +02:00
enricobuehler	f97b5a3783	fix(rpm): drop the moved design/implementation-plan.md from %doc ... The RPM %files %doc referenced design/implementation-plan.md, but the design/ docs live in the separate planning repo now — the file isn't in the public tree, so rpmbuild failed at %files ("File not found: .../implementation-plan.md") once the build got that far. Ship the two docs that actually exist (README.md + packaging/README.md). Pre-existing spec rot, surfaced by the 0.8.3 release run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> v0.8.3	2026-07-08 00:44:28 +02:00
enricobuehler	0052a6ae30	fix(packaging): vulkan-headers build dep + ship punktfunk-session across desktop packages ... The re-architecture split the Linux client into two binaries (shell + Vulkan session streamer) and added the pf-ffvk crate, whose build.rs runs bindgen over FFmpeg's libavutil/hwcontext_vulkan.h (#include <vulkan/vulkan.h>). Two release regressions fell out of that on the desktop-package legs: 1. Missing build dep. The Arch build (archlinux:base-devel + its own pacman list) fatal-errored at `vulkan/vulkan.h file not found`. Add the Vulkan dev headers wherever the client compiles from a self-managed dep set: arch (PKGBUILD makedepends + arch.yml), rpm (spec BuildRequires + rpm.yml + fedora image), deb.yml (belt-and-suspenders; the rust-ci image already bakes libvulkan-dev), and the screenshots job. The flatpak builds offline against the GNOME SDK, so install Vulkan-Headers into /app as a pinned module and point pf-ffvk's bindgen at it via PF_FFVK_VULKAN_INCLUDE. 2. Only the shell shipped. arch/deb/rpm built and installed just punktfunk-client; the shell execs its sibling punktfunk-session for a connect, so desktop streaming would break exactly as Decky's did. Build and install BOTH binaries in all three, and declare the runtime Vulkan loader the session binary dlopens (vulkan-icd-loader / vulkan-loader / libvulkan1 — not a DT_NEEDED, so shlibdeps/auto-requires can't see it). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:41:10 +02:00
enricobuehler	062a54e3a5	style: cargo fmt --all (rustfmt 1.96.0 drift across the re-arch branch) ... `cargo fmt --all --check` (ci.yml) was red on main: the client re-architecture commits and origin's windows-shortcut commit landed with rustfmt violations (e.g. a 104-char .with_context line in hyprland.rs, an unsorted mod block in vdisplay.rs, the input.rs `{`-placement CI flagged). Reformat the tree so the fmt gate passes; no functional changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:33:40 +02:00
enricobuehler	966758e757	chore(release): bump workspace version to 0.8.3 ... Release 0.8.3: the native Linux client is re-architected — the GTK4 shell + GL presenter give way to a two-binary design (phases 0–6). A relm4/libadwaita desktop shell (host discovery, pairing, library) now hands desktop connects to a dedicated Vulkan session binary, punktfunk-session: an SDL3 window + ash presenter carrying a Skia "console" UI — stats OSD, capture HUD, and a gamepad-navigable coverflow library with --browse. The split lands the streaming wins the GL path couldn't: VAAPI dmabuf → Vulkan zero-copy import + CSC (no GL round-trip), Vulkan Video decode on the presenter's own device for NVIDIA hardware decode (via a new pf-ffvk bindgen shim over FFmpeg's Vulkan hwcontext), and HDR10/P010 end to end. The console background is now an animated mesh gradient matching the Apple client's MeshGradient. Along the way: a resize crash fixed (never vkDeviceWaitIdle while the pump decodes), keyframe recovery when the decoder produces no output, decode-stage stats that measure GPU completion, an Alt+Enter fullscreen alias, pointer-lock + per-iteration motion-flush input fixes, and the host-card hover highlight made concentric. Packaging + Decky: the flatpak now builds and ships BOTH client binaries (shell + session) so the Deck's stream/browse paths survive the split — the session binary's Skia is fetched offline from a pinned, sha256-verified archive; the mgmt/library port 47990 is opened on the LAN firewall profiles; and the plugin's install-from-URL uses the unom.io/pf-decky short link. Other clients + core: Windows gains the two missing stream shortcuts (Ctrl+Alt+Shift+S stats, F11 fullscreen) plus an in-stream shortcut reference on both clients; Android promotes the low-latency pipeline to default and attaches its APK to CI; the host coalesces keyframe-request storms into one IDR per cooldown; the core jumps to live on a standing receive backlog instead of ratcheting latency; and two security bumps clear the audits (crossbeam-epoch RUSTSEC-2026-0204, vulnerable web transitive deps). The [workspace.package] version (inherited by every crate via version.workspace) is the release being cut; refresh the 14 workspace entries in Cargo.lock to match (CI builds --locked). Canary derives from the tag as minor+1 of the latest stable (scripts/ci/pf-version.sh), so with 0.8.3 the newest stable it stays at 0.9.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:18:12 +02:00
enricobuehler	07afa8ee26	feat(console-ui): mesh-gradient background (Apple MeshGradient parity) ... The console UI's animated background was a port of the Apple client's LEGACY fallback — four drifting radial blobs. Apple's shipping look is a 4×4 MeshGradient. Replace the blob field with an SkSL shader that reproduces it: a smooth bicubic (separable cubic-Bézier) blend of the same 16 sRGB mesh colours, the four interior control points driving a bounded (weight-normalised) domain warp so the bright brand-violet pools drift while the frame edges stay pinned — then the same ±8°/~5-min hue sway, elliptical vignette, and vertical legibility scrim as the Swift composite(). Same [u_res, u_t] uniforms, so the draw path is untouched beyond the rename (draw_aurora → draw_background, aurora → mesh). Verified: the SkSL compiles on Skia's CPU frontend (unit test), and CPU-raster renders at several time points show the dark-cornered field, the centred bright pool, warm-left/cool-right temperature split, and the slow interior drift. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	b2451e6aea	fix(flatpak): ship punktfunk-session so Decky streaming survives the two-binary split ... The re-architected Linux client is now two binaries: the punktfunk-client shell execs its sibling punktfunk-session (ash/Vulkan presenter + Skia console UI) for --connect/--browse. The Decky plugin's stream and browse paths launch the shell with exactly those flags, but the flatpak built and installed only the shell, so streaming and the gamepad library from the Deck failed at exec with "punktfunk-session: No such file" (pair/wake/library still worked — the shell handles them in-process). Build and install both binaries. The session binary pulls in Skia (skia-safe), whose build script downloads a prebuilt libskia — dead in the offline sandbox — so point skia-bindings at a pinned, vendored archive via SKIA_BINARIES_URL=file:// (read directly, no curl); the tarball rides along as a sha256-pinned flatpak source. Widen the flatpak CI path filters to the session binary's crates (linux-session, pf-presenter, pf-console-ui, pf-client-core) and fix the moved library.rs path in the Decky error-classifier comment. All other plugin↔client contracts (flags, pairing/library output, config files, env vars, exit codes, the 47990 mgmt port) already match — no changes needed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00
enricobuehler	8926d82a80	fix(shell): concentric hover-highlight radius on host cards ... The FlowBoxChild draws the hover/selection highlight AROUND the card (it wraps it with its own padding ring), so its default corner radius ran visibly tighter than the card's 12px inside it. The host grids now scope a 15px radius onto their children — card radius + the ring — so the highlight's corners run concentric with the card's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:14:08 +02:00